refactor: item 29 cleanup

A10 A11 A12 A13 A14 A15 X10 X11 X12: role check denies outside a request, no API versioning, open-in-view off, no passwords in toString, X-Forwarded-For only from private peers, CORS from APP_FRONTEND_URL, non-root image.

readme.md

@@ -157,6 +157,12 @@ classes (`AbstractUnitTest`, `AbstractWebMvcTest`, `AbstractPersistenceTest`, `A
 the base classes carry every annotation, so each kind starts one Spring context. A test with its own annotations
 starts another one.
 
+**Mirrored in Core.** These files exist in both services with small differences; a change in one needs the same
+change in the other: `ClientHeaderFilter`, `RoleAuthorizationManager`, `MethodSecurityConfig`, `Role`, `RequiresRole`,
+`Public` (Core also has `Internal`), `UserPrincipal`, the login token check in `JwtService.parseLoginToken`, the
+ArchUnit role rules (`RoleAnnotationRules`) and `src/test/resources/contract/auth-core-contract.json`
+(`ToBePlayed-Deployment/scripts/check-contract.sh` compares the two).
+
 ### Login flow
 
 ```mermaid
@@ -280,7 +286,7 @@ Needs Java 25, Docker and your own keys.
 ```
 
 Spring Boot's Docker Compose support starts PostgreSQL from `compose.yaml`, Flyway applies the migrations, and the
-service listens on `http://localhost:8080`. Health: `/actuator/health`, metrics: `/actuator/prometheus`.
+service listens on `http://localhost:8080`. Health: `/actuator/health` (the only open actuator endpoint).
 
 The cookies are host-only unless `APP_AUTH_COOKIE_DOMAIN` is set; production sets it to the parent domain, so Core
 gets the access cookie too. Browsers accept `Secure` cookies on `http://localhost`, so local development needs no
@@ -317,7 +323,7 @@ Runs unit, WebMvc, persistence and integration tests plus the ArchUnit rules. Ne
 
 ## Roadmap
 
-- Account deletion and data export.
+See `ROADMAP.md` in the ToBePlayed-Deployment repo.
 
 ## License